CVE-2020-6836

Katalog CVE

CVSS 9.8 · Critical EPSS 2,1%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada hot-formula-parser project hot-formula-parser. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

grammar-parser.jison in the hot-formula-parser package before 3.0.1 for Node.js is vulnerable to arbitrary code injection. The package fails to sanitize values passed to the parse function and concatenates them in an eval call. If a value of the formula is taken from user-controlled input, it may allow attackers to run arbitrary commands on the server.

Rincian

Terbit di NVD

11 Januari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

2,1% peluang dieksploitasi; lebih tinggi dari 81,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/handsontable/formula-parser/commit/396b089738d4bf30eb570a4fe6a188affa95cd5e patch
• https://www.npmjs.com/advisories/1439 patch · advisory pihak ketiga
• https://blog.truesec.com/2020/01/17/reverse-shell-through-a-node-js-math-parser/